The vulnerability is caused by an integer overflow error within the "ReadImage()" function in plug-ins/file-bmp/bmp-read.c. This can be exploited to cause a heap-based buffer overflow by e.g. tricking a user into opening a specially crafted BMP file.
Disclosure Timeline:
02/11/2009 - Vendor notified.
02/11/2009 - Vendor response.
09/11-2009 - Fixed in the GIT repository.
12/11/2009 - Public disclosure.
-------------------------------------------------------------------------------------------------------------------------------
This vulnerability and over 10,000 others are identified and reported by AVDS, the most technically sophisticated network vulnerability assessment and management system available.
*
